Evangelos Mourikis

🚨KQL Alarm🚨 RedCanary recommends to create a Policy wich opens js files in Notepad (https://lnkd.in/dBmm5iJe) to prevent the execution of malicious payloads. This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file). Links to Query: https://lnkd.in/dcR2wkDN https://lnkd.in/dpwePuVE #KQL #Microsoft #Defender #ThreatHunting #Cybersecurity #ThreatDetection #SOC #detectionsai

309

4 Comments

New Sigma release r2025-07-08 is available for download. 🌟43 New Rules 🛡️34 Rule updates 🔬27 Rule Fixes Explore the full release -> https://lnkd.in/eWG6VJgD This release introduces a bunch of new rules including detections for - Katz Stealer - MeshAgent usage - CVE-2025-33053 and CVE-2025-49144 (Notepad++) - Kerberos Coercion Via DNS SPN Spoofing And much more. We've also introduced a new Github action to automate the generation of MITRE heatmaps every month. A special thanks to the many contributors that helped shape this release, specifically 0xFustang, Alfie Champion Ariel Otilibili Anieli Milad Cheraghi Daniel Degasperi david-syk, egycondor, _ezlucky_, frack113, Grégory Wychowaniec, GrepItAll, hashdr1ft, Josh Nickels Cameron Roberts, David Faiß, Gameel Ali Nik Stuckenbrock, norbert791 Christian B. Swachchhanda Shrawan Poudel, unicornofhunt, vx3r, wieso-itzi Mohamed Ashraf Gábor Lázár

153

1 Comment

Hi security practitioners, MITRE is launching the new eCTF Pro League - https://lnkd.in/eDBQHTZS. It is a version of eCTF for non-students, and MITRE will use this as a training program for young professionals working in the area of embedded security.

50

2 Comments

𝐑𝐮𝐬𝐬𝐢𝐚𝐧 𝐜𝐚𝐦𝐩𝐚𝐢𝐠𝐧 𝐭𝐚𝐫𝐠𝐞𝐭𝐢𝐧𝐠 𝐑𝐨𝐦𝐚𝐧𝐢𝐚𝐧 𝐖𝐡𝐚𝐭𝐬𝐀𝐩𝐩 𝐧𝐮𝐦𝐛𝐞𝐫𝐬 I've identified a campaign with dozens of domains that exploit WhatsApp's linked devices feature to access the victims' accounts. You can find more details and a list of domains in the blog post: https://lnkd.in/dgpzyf8a #osint

28

❗Vulnerability Assessment ≠ Penetration Test ❗ 𝗞𝗲𝘆 𝗱𝗶𝗳𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀 Vulnerability assessments are broad in coverage but narrow in depth in terms of understanding organisational risk. For example: Conducting a vulnerability scan against servers and workstations within an internal enterprise environment will provide information about flaws affecting these systems and some conclusions about the overall risk to the organisation could be drawn, but it would be limited to a workstation/server perspective. Penetration tests go deeper than vulnerability assessments by not only identifying, but also exploiting and demonstrating attack paths through an environment. The goal here is to identify and measure the risks associated with the exploitation of the targets attack surface. For example: A flaw was discovered on an internal environment. Through exploitation, it was discovered that this flaw grants privileged access to the server. It was possible to exploit this flaw, gain privileged access and then move laterally and compromise other critical systems on the network. In the example above, by adding in exploitation and attack path validation, the business can quickly see how much risk the organisation would face if they did not properly mitigate the identified flaw/s. 𝗧𝗟𝗗𝗥: 💥 Vulnerability assessment: Focuses on flaw identification with a wide scope, lots of coverage but only information about organisational risk from the level at which they are conducted at. 💥 Penetration test: Focuses on exploitation and attack path validation against a wide scope to help determine the overall risk to the organisation from identified flaws. So which approach? Use both! But if your penetration test reports don't include any exploitation whatsoever and provide no insight into helping your org determine the overall risk, you've probably had a vulnerability assessment. Want to talk to offensive security testing experts 👇 https://lnkd.in/eMeS6W_H

719

33 Comments

We (Beetles Cyber Security Ltd.) recently delivered an engaging session on Industrial Network Security, focusing on the threats and defenses surrounding ICS, SCADA, and OT systems. It was an incredible experience to share insights on how attackers exploit vulnerabilities in industrial networks, often beginning with corporate IT environments and moving laterally into operational systems. During the talk, we showcased a live hacking demo that walked the audience through a simulated attack. Starting with a spear-phishing attack using a malicious Word document, we demonstrated how an attacker could gain initial access to a fictional large industry's corporate office. From there, we executed lateral movement, credential dumping, and eventually infiltrated the factory network. Using remote C2 channels and VNC, the attack culminated in physically shutting down the facility by corrupting PLC codes, leading to severe equipment damage. We also discussed real-world incidents like Stuxnet, the 2014 German steel mill attack, and the 2015 Ukraine power grid breach, drawing lessons from these significant events. On the defensive side, we highlighted the importance of frameworks like MITRE ATT&CK for ICS and CIS Critical Security Controls, empowering organizations to fortify their defenses. A big thank to the Society of Chittagong IT Professionals (SCITP) for hosting this event and giving us the opportunity to share our knowledge and experiences. #CyberSecurity #IndustrialSecurity #ICS #SCADA #OffensiveSecurity #LiveDemo #CriticalInfrastructure #CyberDefense #CyberResilience #IndustrialCyberSecurity #BEETLES #PentestingRedefined

55

2 Comments

The exploitation of the Cross-Site Tracing (XST) vulnerability through the TRACE method on the Apache 2.4.57 server poses a critical risk to the confidentiality, integrity, and security of the application and its users. This vulnerability can be weaponized in conjunction with other client-side attacks, such as Cross-Site Scripting (XSS), allowing attackers to bypass Same-Origin Policy (SOP) protections, steal sensitive information, and escalate privileges. Since TRACE reflects HTTP headers back to the client, sensitive data like authentication tokens, session cookies, or custom headers could be exposed to unauthorized parties. After you find using Nmap as an example a host that has the 'Trace' Method enabled on outdated apache server that are never updated, you can try this one-liner to see if you get in the response the payload example, then you could chain it with other payloads to dig deeper and convert the exploit into a more critical one: curl -X TRACE -H "Test: Exploit" http://host #bugbounty #pentesting #exploitation #hacking #redteam #offensivesecurity #nmap

189

8 Comments

🚨 Tirreno: Open-source fraud prevention platform 🔴 Tirreno is an open-source fraud prevention platform designed as a universal analytics tool to monitor online platforms, web applications, SaaS products, digital communities, mobile apps, intranets, and e-commerce websites. 👇Github👇 https://lnkd.in/dfsVR-fR 👇Demo👇 https://play.tirreno.com/

534

13 Comments

Insider Threat Matrix: Practical Prevention and Detection! Insiders often have access to systems, data, and processes, making detecting and preventing malicious activities harder. Handling insider threats requires a well-thought-out incident response strategy to quickly identify, contain, and mitigate the damage. The Insider Threat Maturity Matrix categorizes and detects activities that could indicate malicious or negligent insider behavior. • Suspicious Intranet Activity • Activity Outside of Normal Scope • Creation of New Accounts • Downloads from Email/IM/Chat • Screenshots • Downloading from Internal File Share • Uploads to 3rd Party File Share • Use of Removable Storage Devices • External Email with Attachments • Destruction of Physical Device The matrix also addresses the proactive measures and business impact by identifying data exposure, misappropriations, and malicious system changes, ensuring a swift response to limit damage. Source: https://lnkd.in/gdQiGxke Advanced data analysis techniques are key in identifying anomalies, detecting suspicious behavior, and correlating patterns that indicate potential insider threats. Discover over 10+ essential data analysis techniques for effective threat hunting in my "Cyber Threat Hunt 101" YouTube series, explained simply: https://lnkd.in/gkVB6B2j Please share and subscribe if you enjoy the content! #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

136

3 Comments